Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 70159 - glsa-check not checking GLSA 200403-03 properly
Summary: glsa-check not checking GLSA 200403-03 properly
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Unspecified (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Portage Tools Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-11-05 06:00 UTC by Frank Barton
Modified: 2004-12-03 05:51 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Frank Barton 2004-11-05 06:00:52 UTC 
GLSA 200403-03 specifies certain packages of openssl to be vulnerable, and certain ones to be non-vulnerable.

While running a non-vulnerable version glsa-check wants to emerge an older non-affected package

Reproducible: Always
Steps to Reproduce:
1.glsa-check -p 200403-03
2.
3.

Actual Results:  
It listed the older package

Expected Results:  
it should have reported not-affected

Checking GLSA 200403-03
The following updates will be performed for this GLSA:
     dev-libs/openssl-0.9.6m (0.9.7d-r1)

bartof@bartof:~$ emerge openssl -p

These are the packages that I would merge, in order:

Calculating dependencies ...done!
[ebuild   R   ] dev-libs/openssl-0.9.7d-r1  



Affected packages
================= 

    -------------------------------------------------------------------
     Package           /   Vulnerable   /                   Unaffected
    -------------------------------------------------------------------
     dev-libs/openssl       <= 0.9.7c                        >= 0.9.7d
     dev-libs/openssl       <= 0.9.7c                        == 0.9.6m


It appears that glsa-check looked at the last portion, and ignored the first
option for unaffected packages
Comment 1 Marius Mauch (RETIRED) gentoo-dev 2004-11-05 16:53:00 UTC 
Security: That GLSA seems to be broken.
Comment 2 Thierry Carrez (RETIRED) gentoo-dev 2004-11-06 01:23:08 UTC 
GLSA syntax looks ok to me and it works when using latest glsa.py gentoolkit. Maybe (one more) bug 65664 dupe ?

pioneer root # glsa-check -p 200403-03
WARNING: [...]

Checking GLSA 200403-03
Nothing to do for this GLSA

pioneer root # etcat versions dev-libs/openssl

*  dev-libs/openssl :
        [   ] 0.9.6m (0)
        [M~ ] 0.9.7c (0)
        [M  ] 0.9.7c-r1 (0)
        [   ] 0.9.7d (0)
        [  I] 0.9.7d-r1 (0)
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2004-12-01 09:14:33 UTC 
Reporter: is this still a problem with gentoolkit-0.2.0_pre10 ?
Comment 4 Frank Barton 2004-12-03 05:51:57 UTC 
Seems to be working now, Marking as FIXED